Qi Blocks, CVE-2025-1626

CVE, Research URL: CVE-2025-1626
Home page URL: Security reports for Qi Blocks
Application: Qi Blocks
Published on: May 19, 2025
Research Description: The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Affected versions: Min -, max 1.4.
Status: vulnerable